CVE-2021-25971

Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature

State: Published
Severity: 4.3 Medium
Published: Oct 20, 2021
Updated: Apr 30, 2025
Reserved: Jan 22, 2021

Description

In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	Mend

Weaknesses

CWE-248 Uncaught Exception

Affected Products

Product	Versions
camaleon_cmscamaleon_cms	2.0.1 to before unspecifiedAffected 2.6.0 and earlierAffected

References

https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25971

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.